DuckDuckGo Web Tracking Protections

DuckDuckGo is committed to providing extensive web tracking protections, recognizing that privacy requires continuous evolution to counter tracker evasion. Unlike most browsers that focus primarily on cookie and fingerprinting protections after trackers have loaded, DuckDuckGo's approach involves stopping most third-party trackers from loading initially, thereby preventing data exposure like IP addresses. These protections, many of which are not offered by default in other browsers, include 3rd-Party Tracker Loading Protection, Global Privacy Control, Link Tracking Protection, CNAME Cloaking Protection, and Google AMP Protection. DuckDuckGo's Tracker Radar, an open-source tool, identifies trackers to build the lists used for these protections. The goal is to prevent the majority of third-party tracking while striving to maintain site functionality, ensuring that privacy measures do not interfere with browsing experience, sign-ins, or online purchases.

DuckDuckGo implements several key protections: 3rd-Party Tracker Loading Protection: This feature prevents most 3rd-party tracking requests from loading, stopping trackers from gathering data like IP addresses before they can even initiate. It uses the Tracker Radar to identify and block tracking URLs, such as Google Analytics. This is a significant enhancement over typical browser protections that only restrict trackers after they've loaded. 3rd-Party Cookie Protection: Beyond blocking loading requests, DuckDuckGo automatically blocks 3rd-party cookies from known trackers. These cookies are notorious for cross-site tracking, enabling advertisers to follow users across different websites. 1st-Party Cookie Protection: While generally less intrusive, 1st-party cookies can still contribute to tracking. DuckDuckGo blocks many embedded 3rd-party tracking requests that might set 1st-party cookies and, for unblocked 3rd-party scripts, enforces a 24-hour expiration on their 1st-party cookies, with a 7-day expiration for others, limiting their tracking potential. CNAME Cloaking Protection: This addresses a technique where 3rd-party trackers disguise themselves as subdomains of the website being visited to bypass standard protections. DuckDuckGo's Tracker Radar identifies these cloaked domains and treats them as proper 3rd parties, applying relevant protections. Fingerprinting Protection: To combat device fingerprinting, where unique browser and device information is combined for identification, DuckDuckGo blocks many fingerprinting scripts from loading and overrides browser APIs to return less useful information, safeguarding user anonymity. Smarter Encryption (HTTPS Upgrading): This protection automatically upgrades HTTP connections to HTTPS for sites listed as fully supporting encryption, ensuring that user data transferred over the internet remains secure and private. This covers all clicks and interactions, unlike some browsers' limited HTTPS upgrades. Link Tracking Protection: DuckDuckGo removes common tracking parameters from URLs, preventing advertisers and sites from collecting behavioral data as users navigate the web. Referrer Tracking Protection: It trims metadata in the 'referrer header' to the hostname for 3rd-party requests, reducing the amount of identifying information sent to other sites. Embedded Social Media Protection: This blocks embedded content from social media platforms like Facebook (e.g., sign-in buttons, videos, comments) that often contain tracking code, preventing these companies from linking user information with browsing history.

DuckDuckGo offers specialized protections against Google's tracking mechanisms: Google AMP Protection: Instead of Google-hosted Accelerated Mobile Pages (AMP) that can be used for tracking, DuckDuckGo replaces these links with the original publisher's website version, ensuring direct access and circumventing potential Google tracking. Google Topics Protection: For Chrome users, DuckDuckGo's extension disables Google's Topics API, an alternative tracking mechanism intended to replace 3rd-party cookies by inferring user interests from browsing history and sharing them with advertisers. Google Protected Audience API Protection: Similar to Topics, this API (formerly FLEDGE) also aims to re-target users with ads. DuckDuckGo's Chrome extension disables this API to prevent Google from running ad auctions based on browsing history. Google Sign-In Pop-Up Protection: DuckDuckGo blocks intrusive Google sign-in pop-ups on non-Google-owned sites. This prevents users from inadvertently granting Google more data collection permissions and allows them to choose alternative sign-in methods.

DuckDuckGo prioritizes site functionality alongside privacy: Surrogates: When 3rd-Party Tracker Loading Protection might break a site that relies on embedded tracking scripts, DuckDuckGo can provide 'surrogates' – small code pieces that mimic the script's functionality without any tracking, ensuring the site works as intended. Remotely Configured Exceptions: DuckDuckGo actively addresses user-reported broken site issues by temporarily creating exceptions for specific domains or cookies, continually refining protections to prevent widespread usability problems. Infrastructure Domains: Recognizing that some 3rd-party domains are essential for site functionality (e.g., CDNs, tag managers), DuckDuckGo evaluates individual resources loaded from these domains, blocking only the tracking-specific elements while allowing legitimate components. DuckDuckGo Private Search Ads: DuckDuckGo works with Microsoft for anonymous search ads. While limited tracking for conversion measurement from DuckDuckGo ad clicks might occur via 'bat.bing.com' for advertisers, this is restricted and subject to other protections. DuckDuckGo aims to guide the advertising industry towards privacy-preserving conversion technologies. Everyday Privacy Controls: The Fire Button: This feature allows users to instantly clear browsing data (cookies, cache, history, permissions) from the DuckDuckGo app's local storage. Users can also 'Fireproof' specific sites to retain helpful data like sign-in cookies. Cookie Pop-Up Protection: DuckDuckGo automatically attempts to set cookie preferences to maximize privacy and close pop-ups. For sites lacking preference options, it hides the pop-up, offering a more private alternative to accepting all cookies. Global Privacy Control (GPC): This sends a signal to websites indicating the user's preference not to have their personal information sold or shared, aiding in exercising legal privacy rights like CCPA and GDPR.

Users can access DuckDuckGo's web tracking protections by installing their apps or extensions for various platforms including Firefox, Chrome, Edge, Opera, iPhone & iPad, Android, Mac, and Windows. Many of these tools and the underlying Tracker Radar are open-source, allowing transparency and community scrutiny. DuckDuckGo encourages users to contact them with any questions or concerns.